Payroll teams are losing whole runs of direct deposits to criminals who break into a CFO’s email, watch for the word “ACH,” and paste in a new routing number minutes before the file uploads to the bank.
The scheme is older than generative AI, but finance departments tightened controls during remote work and then relaxed them as staff returned hybrid. Attackers exploit that drift. They register lookalike domains, compromise a vendor mailbox, or phish an executive assistant with a fake DocuSign link. Once inside, they do not announce themselves. They archive real messages, set inbox rules that forward threads to an outside account, and wait for the monthly payroll approval chain.
How the payroll swap works
In the version federal agents describe most often, the criminal inserts themselves into an existing thread about “Q4 contractor payments” or “updated W-9.” The body looks boring: a PDF invoice, a note that banking details changed after a merger, a polite ask to “use the attached account for this week only.” The attachment is sometimes a real PDF with altered account numbers on page two.
Payroll software does not know the difference between a legitimate HR update and a forged one if the person clicking “approve” trusts the email chain. ACH batches move fast. Same-day ACH windows mean a mistaken file can settle before the CFO returns from lunch. Recovery depends on how quickly the company calls its bank, files a FinCEN SAR, and reports to the FBI’s Internet Crime Complaint Center. Even then, money routed through mule accounts overseas may be gone.
Controls that actually slow thieves
Security vendors sell AI classifiers, but investigators still praise low-tech habits. Require a phone call—not a reply email—to confirm any change to beneficiary banking data. Split duties so the person who receives a change request cannot also release the ACH file. Use out-of-band codes for wire approvals above a dollar threshold your firm can live with.
Enable multi-factor authentication on every finance inbox, including shared mailboxes that receive invoices. Attackers love legacy POP accounts and auto-forward rules; audit them quarterly. If you use Microsoft 365 or Google Workspace, turn on advanced phishing protection and logins from impossible travel locations.
What employees should do if pay is late
Workers who wake up to an empty deposit should contact payroll through a known phone number, not a link in an “HR update” email. Employers should post a verified status line on the intranet and tell staff whether they will reissue ACH or cut paper checks. Document everything for cyber-insurance carriers; policies often exclude losses when dual controls were disabled.
Report the incident to IC3.gov and your local FBI field office even if the amount seems embarrassing. Agents use those reports to map mule networks and to warn other firms in the same metro. The attack is not a sign your company is uniquely careless. It is a sign criminals treat payroll ACH like a high-yield wire transfer—and they only need one tired approver on a deadline.
Insurance and vendor due diligence
Cyber-insurance underwriters now ask whether payroll changes require callback verification. A “no” answer can void coverage after a six-figure loss. Update your incident-response playbook to include payroll providers such as ADP, Paychex, or Rippling, not only your core bank.
Vendor onboarding should capture banking details through a portal that logs IP addresses and timestamps. Email attachments with routing numbers should be treated as untrusted even when the sender domain looks correct. Spoofing the CFO’s display name is trivial; matching the full return-path domain is not.
Small municipalities and school districts are frequent targets because they run predictable payroll dates and often lack dedicated security staff. State comptrollers have begun publishing sample dual-control policies; adapt them before the next audit, not after a fraud event.